Back www.cyber.gc.ca

Citrix Security Advisory Av26 965

www.cyber.gc.ca • October 6, 2026

Share: View original

As of September 27, 2026, Citrix is affected by vulnerabilities in the following products:

NetScaler ADC and NetScaler Gateway 14.1 Prior to 14.1-73.37

NetScaler ADC and NetScaler Gateway 13.1 Prior to 13.1-64.23

NetScaler ADC FIPS Prior to 14.1-73.37 FIPS

Prior to 14.1-73.37 FIPS

NetScaler ADC FIPS and NDcPP Prior to 13.1-37.279

On September 27, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88771 and CVE-2026-88772 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix Security Advisories

CISA KEV: CVE-2026-88771

CISA KEV: CVE-2026-88772

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited In late September 2026, two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler ADC and Gateway were actively exploited, allowing remote code execution. The Cybersecurity and Infrastructure Security Agency (CISA) added these CVEs to its Known Exploited Vulnerabilities catalog on September 27, 2026, with a CVSS score of 9.5. Attackers utilized custom web shells named WHIPSHOT and SLAPSHOT to gain unauthorized access to affected systems. Organizations in sectors such as government, finance, and healthcare were particularly vulnerable. Citrix has since released patches for these vulnerabilities, but the urgency of the situation has raised concerns about the effectiveness of their response. The incidents highlight the ongoing risks associated with internet-exposed edge devices and the need for rapid incident response. As of October 4, 2026, the exploitation is confirmed to be ongoing, with significant operational and compliance risks reported. 38 sources 80

Extracted Entities

Citrix Security Advisory Av26 965

The full story

Extracted Entities

Companies (1)

CVEs (8)

Platforms (2)